[EN] Spam Levels Spike

By shipping banking Trojans and ransomware that turn big profits fast, spammers can now afford the high overhead of high-volume spam campaigns.

Sara Peters
9/23/2016

Spam volumes are at their highest volumes since mid-2010 and the reason isn't an advancement in spambot technology or a surge of new spammers: it's simply a new business strategy, according to researchers at Cisco Talos Labs.

Before 2016, the researchers say, the SpamCop Block List size "hovers somewhere under 200K IP addresses." More recently, the averages are "closer to 400K IP addresses, spiking to over 450K IPs in August."

The main culprit is the Necurs botnet, which brought back a mostly outdated tactic in 2016: high-volume spam in which bots launch a huge amount of spam in a very short amount of time. This method is easy for spam filters to detect and block, so it's mostly fallen into disuse, in favor of stealthier, more targeted, low-volume trickles of spam.

"What could possibly be the advantage for spammers to crank up the volume?" the researchers wrote in a blog posted Wednesday.

The Necurs operators, instead of aiming for persistence, have been aiming for speed. The window of opportunity before a spam filter kicks in may only be minutes or even seconds, so Necurs has transmitted as much email as possible. And for a short time they may land some malware successfully, the researchers say.

Earlier in the year, there were a several notable spikes in spam volumes. During that time, Necurs mostly sent Russian dating or "pump and dump" stock spam. However, in June the botnet shifted tactics and began to push malicious attachments, which mostly propagated the Dridex banking Trojan and Locky ransomware. Since then, high-volume spam campaigns have been a constant.

Craig Williams, senior technical leader and security outreach manager for Cisco Talos Labs, explains that the Necurs operators can afford to run such short-term campaigns "because they've moved towards payloads that are more profitable."

As they become more profitable, "they can have more overhead," he says.

Another contributing factor to Necurs' success is that they may have picked up some of the customers left high-and-dry after the Lurk takedown that also took out the Angler exploit kit.

Williams cautions that if this method works for Necurs, if it is economically viable, then there will be copycats; so we'd better get our spam protections ready.

Large Botnet Comes Back To Life -- With More Malware

The Necurs botnet associated with Dridex and Locky is back after three-week haitus.

Jai Vijayan
6/23/2016

A botnet associated with the huge volumes of Dridex and Locky-laden emails in recent months has resumed operations after mysteriously going dark for three weeks.

Researchers from multiple firms report seeing a sharp increase in malicious traffic originating from the Necurs botnet, after a significant drop-off beginning May 31.

AppRiver security analyst Jonathan French spotted the botnet back in action on June 21 in the form of a massive Locky email campaign. From an average of between three million- to 10 million emails with malicious attachments per day since the beginning of June, the number suddenly shot up to 80 million malicious emails on June 21, and 160 million on June 22, French said.

“It looks like Necurs is coming back and ramping up,” he said in a blog post this week. “Whether or not this is a temporary spike or a return to pre-June 1 “normalcy” is too early to tell.”

French told Dark Reading says it remains unclear why Necurs apparently went offline for sometime and then came back up again just as abruptly. “This is the question everyone is asking now. While it’s pretty apparent the botnet wasn’t taken down, no one is entirely sure why it went offline for three weeks,” he says.

One possibility is that the operators of the botnet encountered technical issues and were busy trying to fix it, or they were adding new functionality to it, he says. But a three-week hiatus seems too long to fully account for either possibility. “With how large the botnet is and how successful it’s been, it seems odd any issue they ran across would have taken three weeks to overcome,” he says.

Another likelihood is that the botnet has changed hands and is now under the control of a new set of operators, French says.

Regardless, the reactivation of Necurs is bad news, notes Kevin Epstein, vice president of the threat operations center at Proofpoint, which also reported seeing a sharp spike in malicious traffic from the botnet. Proofpoint reported Necurs-related traffic over the last two days as being about 10% of the volume prior to June 1. Still, the campaign remains very large and dangerous, the company says.

Like French, Epstein is at a loss to explain the sudden lull in activity earlier this month. But he, too, speculates that the botnet operators might have run into issues with their command and control infrastructure.

In similar cases such as the temporary cessation last August of the Dridex botnet and its spread of the Nuclear exploit kit, the disruptions stemmed from law enforcement actions, he says. But there has been nothing to indicate the same is true of Necurs. He conjectures that the reason why the botnet has resumed operations is simply because of the money to be made in distributing ransomware.

“The Locky ransomware and Dridex banking Trojan are too lucrative for the threat actors behind them to stay quiet for long," he says.

According to Proofpoint, the Locky sample coming via the newly revived Necurs botnet is more sophisticated than previous versions and includes new evasion and sandboxing techniques that make it much harder to detect and stop.

MalwareTech, an outfit that operates a botnet tracker, described Necurs as comprised of seven smaller botnets, with a total of around 1.7 million infected systems. All of the botnets went offline around the same time on May 31, stayed offline for the same length of time, and revived at the same time. That suggests the same organization is in charge of all seven botnets, MalwareTech noted.